ACK: [PATCH] arm64: kernel: restrict /dev/mem read() calls to linear region

[Kleber Souza]

On 09/14/17 15:24, Manoj Iyer wrote:
> From: Ard Biesheuvel <ard.biesheuvel at linaro.org>
> 
> When running lscpu on an AArch64 system that has SMBIOS version 2.0
> tables, it will segfault in the following way:
> 
>   Unable to handle kernel paging request at virtual address ffff8000bfff0000
>   pgd = ffff8000f9615000
>   [ffff8000bfff0000] *pgd=0000000000000000
>   Internal error: Oops: 96000007 [#1] PREEMPT SMP
>   Modules linked in:
>   CPU: 0 PID: 1284 Comm: lscpu Not tainted 4.11.0-rc3+ #103
>   Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015
>   task: ffff8000fa78e800 task.stack: ffff8000f9780000
>   PC is at __arch_copy_to_user+0x90/0x220
>   LR is at read_mem+0xcc/0x140
> 
> This is caused by the fact that lspci issues a read() on /dev/mem at the
> offset where it expects to find the SMBIOS structure array. However, this
> region is classified as EFI_RUNTIME_SERVICE_DATA (as per the UEFI spec),
> and so it is omitted from the linear mapping.
> 
> So let's restrict /dev/mem read/write access to those areas that are
> covered by the linear region.
> 
> Reported-by: Alexander Graf <agraf at suse.de>
> Fixes: 4dffbfc48d65 ("arm64/efi: mark UEFI reserved regions as MEMBLOCK_NOMAP")
> 
> BugLink: https://launchpad.net/bugs/1716483
> 
> Signed-off-by: Ard Biesheuvel <ard.biesheuvel at linaro.org>
> Signed-off-by: Will Deacon <will.deacon at arm.com>
> (cherry picked from commit 1151f838cb626005f4d69bf675dacaaa5ea909d6)
> Signed-off-by: Manoj Iyer <manoj.iyer at canonical.com>

Clean cherry-pick, good test results and limited to single architecture.

Acked-by: Kleber Sacilotto de Souza <kleber.souza at canonical.com>

> ---
>  arch/arm64/mm/mmap.c | 19 +++++++++++++------
>  1 file changed, 13 insertions(+), 6 deletions(-)
> 
> diff --git a/arch/arm64/mm/mmap.c b/arch/arm64/mm/mmap.c
> index 01c171723bb3..caf75abf6ae7 100644
> --- a/arch/arm64/mm/mmap.c
> +++ b/arch/arm64/mm/mmap.c
> @@ -18,6 +18,7 @@
>  
>  #include <linux/elf.h>
>  #include <linux/fs.h>
> +#include <linux/memblock.h>
>  #include <linux/mm.h>
>  #include <linux/mman.h>
>  #include <linux/export.h>
> @@ -102,12 +103,18 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
>   */
>  int valid_phys_addr_range(phys_addr_t addr, size_t size)
>  {
> -	if (addr < PHYS_OFFSET)
> -		return 0;
> -	if (addr + size > __pa(high_memory - 1) + 1)
> -		return 0;
> -
> -	return 1;
> +	/*
> +	 * Check whether addr is covered by a memory region without the
> +	 * MEMBLOCK_NOMAP attribute, and whether that region covers the
> +	 * entire range. In theory, this could lead to false negatives
> +	 * if the range is covered by distinct but adjacent memory regions
> +	 * that only differ in other attributes. However, few of such
> +	 * attributes have been defined, and it is debatable whether it
> +	 * follows that /dev/mem read() calls should be able traverse
> +	 * such boundaries.
> +	 */
> +	return memblock_is_region_memory(addr, size) &&
> +	       memblock_is_map_memory(addr);
>  }
>  
>  /*
>